4 ms·

You should not use Homebrew. The maintainers are not trustworthy. https://chr4.org/blog/2016/04/26/homebrew-betrayed-us-all-to-google/ https://chr4.org/blog/20

by wl 8y ago

You should not use Homebrew. The maintainers are not trustworthy. https://chr4.org/blog/2016/04/26/homebrew-betrayed-us-all-to-google/ https://chr4.org/blog/2016/04/26/homebrew-betrayed-us-all-to...

Gaelan 8y ago
TLDR: they turned on Google Analytics.
- sneak 8y ago
  ...without consent or opt-in.
  - coldtea 8y ago
    Because most other websites/services ask for consent for their analytics?
    - saagarjha 8y ago
      "Because everyone else does it" isn't a very good excuse.
    - sneak 8y ago
      Important consideration: homebrew is neither a website nor a service. It is a local software, a package manager, and quietly enabling phone-home analytics in an update after previously not doing such has a different threshold for “informed consent”.
      - Hackbraten 8y ago
        How exactly is Homebrew not a service? We donate hours of work each week in an honest effort to make the best package manager we can for our users. Analytics help us decide how to prioritize our work. It’s also literally the opposite of quietly enabled [1] [2]. [1] https://github.com/Homebrew/brew/blob/e32c1515432a938093d5ef1d8c4b4408991873df/Library/Homebrew/cmd/update-report.rb#L53-L62 https://github.com/Homebrew/brew/blob/e32c1515432a938093d5ef... [2] https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
        wl 8y ago
        > How exactly is Homebrew not a service? Is youtube-dl a service because it needs to be constantly updated, at great effort, to deal with new countermeasures and the like? Still looks like software to me. If you were running the software for me (e.g. Gmail), then maybe Homebrew would qualify as a service. > It’s also literally the opposite of quietly enabled I discovered it when my firewall showed me an outbound connection to Google analytics. Homebrew spews so much stuff to the console, it's not something a regular user would read unless they looked for it. That was hardly sufficient disclosure. You guys could have prompted for consent. You didn't. You still refuse to. And you won't entertain any suggestions that you do so unless it comes from a contributor. As I said in my original comment, your collective lack of judgement and refusal to consider the opinions of users is why I don't find you guys to be trustworthy anymore. I encourage everyone to find alternatives.
        Hackbraten 8y ago
        > If you were running the software for me I’m not sure on whose systems you believe packages are built and tested, and from whose systems you feel Homebrew downloads bottles. > it's not something a regular user would read unless they looked for it. That was hardly sufficient disclosure. That notice was colored, it was typeset in bold, it was surrounded by newlines, and it sounded an audible bell. Blaming Homebrew for the fact that you missed that message says more about you than about Homebrew.
        deleted 8y ago
        [deleted]
        wl 8y ago
        > I’m not sure on whose systems you believe packages are built and tested, and from whose systems you feel Homebrew downloads bottles. Is Ubuntu a service because Canonical builds and tests packages and hosts package repositories? I don't think many people would make that claim. > That notice was colored, it was typeset in bold, it was surrounded by newlines, and it sounded an audible bell. That's not the notice I got. "Anonymous aggregate user behaviour analytics documentation: https://git.io/brew-analytics" https://git.io/brew-analytics". No bold. No bell. The notice you linked to was added in reaction to the outcry. The bold and bell were added at a later date. The Homebrew maintainers continue to refuse to do the only ethical thing and PROMPT THE USER instead of making assumptions one way or another.
- pmarreck 8y ago
  So pretty much like every other website on the Internet. Got it.
  - wl 8y ago
    I don't expect my package manager to require uBlock Origin. I actually caught it with my firewall, which was an unpleasant surprise.
    - Corrado 8y ago
      Doesn't apt track installs?
      - wl 8y ago
        Popcon in Debian and Ubuntu is opt-in. They ask you at install time whether or not you'd like to participate.
    - pmarreck 8y ago
      What is the best argument for anonymized tracking being malicious? I don't understand the alarm over this, and I'm a guy who has passed around Martin Fowler's great essay on privacy https://www.martinfowler.com/articles/bothersome-privacy.html https://www.martinfowler.com/articles/bothersome-privacy.htm...
      - wl 8y ago
        I don't know what Google does with those packets. Also, I've seen far too many examples of deanonymization to trust claims that data is properly anonomyzed. When it comes down to it, principle of least privilege applies here. Homebrew doesn't need to phone home to Google to install packages, so it shouldn't.
robin_reala 8y ago
Saying that the maintainers are untrustworthy because they take an opinion that you disagree with is uncharitable.
- wl 8y ago
  They opted their users in to analytics (using Google, no less) with disclosure so minimal, most users would miss it. They would not entertain any suggestion that analytics should be opt in, saying that unless you're a contributor, your opinion on the matter means nothing. They showed a shocking lack of judgement and an abundance of arrogance. I can't trust them anymore. I don't think others should, either.
pmarreck 8y ago
What is the best argument for anonymized tracking being malicious? I don't understand the alarm over this.
Hamuko 8y ago
Well, I for one don't trust Mike after he forced one of the maintainers to resign and then edited his comment on Github and removed the bit where it said "because Mike forced me to resign".
- saagarjha 8y ago
  Do you have a link to this? I'm curious to learn what happened here; this sounds pretty horrible…
  - Hamuko 8y ago
    https://github.com/Homebrew/brew/pull/4864 https://github.com/Homebrew/brew/pull/4864 The comment that Mike edited is the last one. Clicking on the "edited by MikeMcQuiad" allows you to see the different versions.
    - saagarjha 8y ago
      …wow. I don't know what to say; this is pretty egregious. This seems like it came out-of-the-blue; why was Dominyk forced out? Because he made this pull request?
      - Hamuko 8y ago
        Seems like it's precisely because of that PR. Maybe Mike saw it as a mutiny. But I'm guessing that since he never explained himself in that PR, he's not going to do it at all. It's not like he's unaware of it.
        mikemcquaid 8y ago
        I cannot fully explain this in any public forum without betraying the confidence of things that were said to me in private messages and our private Slack by other maintainers. What I can say is that I do not agree with the claim that I forced DomT4 to resign, it did not come out of the blue, this was the second time that DomT4 has decided to leave the project and all of my decisions were run past other (still active) Homebrew maintainers before I took them.

by wl 8y ago

You should not use Homebrew. The maintainers are not trustworthy. https://chr4.org/blog/2016/04/26/homebrew-betrayed-us-all-to-google/ https://chr4.org/blog/2016/04/26/homebrew-betrayed-us-all-to...

Gaelan 8y ago

TLDR: they turned on Google Analytics.

sneak 8y ago
...without consent or opt-in.
- coldtea 8y ago
  Because most other websites/services ask for consent for their analytics?
  - saagarjha 8y ago
    "Because everyone else does it" isn't a very good excuse.
  - sneak 8y ago
    Important consideration: homebrew is neither a website nor a service. It is a local software, a package manager, and quietly enabling phone-home analytics in an update after previously not doing such has a different threshold for “informed consent”.
    - Hackbraten 8y ago
      How exactly is Homebrew not a service? We donate hours of work each week in an honest effort to make the best package manager we can for our users. Analytics help us decide how to prioritize our work. It’s also literally the opposite of quietly enabled [1] [2]. [1] https://github.com/Homebrew/brew/blob/e32c1515432a938093d5ef1d8c4b4408991873df/Library/Homebrew/cmd/update-report.rb#L53-L62 https://github.com/Homebrew/brew/blob/e32c1515432a938093d5ef... [2] https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
      - wl 8y ago
        > How exactly is Homebrew not a service? Is youtube-dl a service because it needs to be constantly updated, at great effort, to deal with new countermeasures and the like? Still looks like software to me. If you were running the software for me (e.g. Gmail), then maybe Homebrew would qualify as a service. > It’s also literally the opposite of quietly enabled I discovered it when my firewall showed me an outbound connection to Google analytics. Homebrew spews so much stuff to the console, it's not something a regular user would read unless they looked for it. That was hardly sufficient disclosure. You guys could have prompted for consent. You didn't. You still refuse to. And you won't entertain any suggestions that you do so unless it comes from a contributor. As I said in my original comment, your collective lack of judgement and refusal to consider the opinions of users is why I don't find you guys to be trustworthy anymore. I encourage everyone to find alternatives.
        Hackbraten 8y ago
        > If you were running the software for me I’m not sure on whose systems you believe packages are built and tested, and from whose systems you feel Homebrew downloads bottles. > it's not something a regular user would read unless they looked for it. That was hardly sufficient disclosure. That notice was colored, it was typeset in bold, it was surrounded by newlines, and it sounded an audible bell. Blaming Homebrew for the fact that you missed that message says more about you than about Homebrew.
        deleted 8y ago
        [deleted]
        wl 8y ago
        > I’m not sure on whose systems you believe packages are built and tested, and from whose systems you feel Homebrew downloads bottles. Is Ubuntu a service because Canonical builds and tests packages and hosts package repositories? I don't think many people would make that claim. > That notice was colored, it was typeset in bold, it was surrounded by newlines, and it sounded an audible bell. That's not the notice I got. "Anonymous aggregate user behaviour analytics documentation: https://git.io/brew-analytics" https://git.io/brew-analytics". No bold. No bell. The notice you linked to was added in reaction to the outcry. The bold and bell were added at a later date. The Homebrew maintainers continue to refuse to do the only ethical thing and PROMPT THE USER instead of making assumptions one way or another.
pmarreck 8y ago
So pretty much like every other website on the Internet. Got it.
- wl 8y ago
  I don't expect my package manager to require uBlock Origin. I actually caught it with my firewall, which was an unpleasant surprise.
  - Corrado 8y ago
    Doesn't apt track installs?
    - wl 8y ago
      Popcon in Debian and Ubuntu is opt-in. They ask you at install time whether or not you'd like to participate.
  - pmarreck 8y ago
    What is the best argument for anonymized tracking being malicious? I don't understand the alarm over this, and I'm a guy who has passed around Martin Fowler's great essay on privacy https://www.martinfowler.com/articles/bothersome-privacy.html https://www.martinfowler.com/articles/bothersome-privacy.htm...
    - wl 8y ago
      I don't know what Google does with those packets. Also, I've seen far too many examples of deanonymization to trust claims that data is properly anonomyzed. When it comes down to it, principle of least privilege applies here. Homebrew doesn't need to phone home to Google to install packages, so it shouldn't.

robin_reala 8y ago

Saying that the maintainers are untrustworthy because they take an opinion that you disagree with is uncharitable.

wl 8y ago
They opted their users in to analytics (using Google, no less) with disclosure so minimal, most users would miss it. They would not entertain any suggestion that analytics should be opt in, saying that unless you're a contributor, your opinion on the matter means nothing. They showed a shocking lack of judgement and an abundance of arrogance. I can't trust them anymore. I don't think others should, either.

pmarreck 8y ago

What is the best argument for anonymized tracking being malicious? I don't understand the alarm over this.

Hamuko 8y ago

Well, I for one don't trust Mike after he forced one of the maintainers to resign and then edited his comment on Github and removed the bit where it said "because Mike forced me to resign".

saagarjha 8y ago
Do you have a link to this? I'm curious to learn what happened here; this sounds pretty horrible…
- Hamuko 8y ago
  https://github.com/Homebrew/brew/pull/4864 https://github.com/Homebrew/brew/pull/4864 The comment that Mike edited is the last one. Clicking on the "edited by MikeMcQuiad" allows you to see the different versions.
  - saagarjha 8y ago
    …wow. I don't know what to say; this is pretty egregious. This seems like it came out-of-the-blue; why was Dominyk forced out? Because he made this pull request?
    - Hamuko 8y ago
      Seems like it's precisely because of that PR. Maybe Mike saw it as a mutiny. But I'm guessing that since he never explained himself in that PR, he's not going to do it at all. It's not like he's unaware of it.
      - mikemcquaid 8y ago
        I cannot fully explain this in any public forum without betraying the confidence of things that were said to me in private messages and our private Slack by other maintainers. What I can say is that I do not agree with the claim that I forced DomT4 to resign, it did not come out of the blue, this was the second time that DomT4 has decided to leave the project and all of my decisions were run past other (still active) Homebrew maintainers before I took them.